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Abstract 

Security organizations often attempt to disrupt terror or insurgent 
networks by targeting "high value targets" (HVT's). However, 
there have been numerous examples that illustrate how such net- 
works are able to quickly re-generate leadership after such an op- 
eration. Here, we introduce the notion of a shaping operation in 
which the terrorist network is first targeted for the purpose of reduc- 
ing its leadership re-generation ability before targeting HVT's. We 
look to conduct shaping by maximizing the network- wide degree 
centrality through node removal. We formally define this prob- 
lem and prove solving it is NP-Complete. We introduce a mixed 
integer-linear program that solves this problem exactly as well as a 
greedy heuristic for more practical use. We implement the greedy 
heuristic and found in examining five real- world terrorist networks 
that removing only 12% of nodes can increase the network- wide 
centrality between 17% and 45%. We also show our algorithm can 
scale to large social networks of 1, 133 nodes and 5, 541 edges on 
commodity hardware. 
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I Introduction 

Terrorist and insurgent networks are known for their ability to re- 
generate leadership after targeted attacks. For example, the infa- 
mous Al Qaeda in Iraq terrorist leader Abu Musab al-Zarqawi was 
killed on June 8th, 2006Qonly to be replaced with Abu Ayyub al- 
Masri about a week later, q] Here, we introduce the notion of a shap- 
ing operation in which the terrorist network is first targeted for the 
purpose of reducing its leadership re-generation ability. Such shap- 
ing operations would then be followed by normal attacks against 
high value targets - however the network would be less likely to 
recover due to the initial shaping operations. In this paper, we look 
to shape such networks by increasing network- wide centrality, first 



introduced in d. Intuitively, this measure provides insight into 
the criticality of high-degree nodes. Hence, a network with a low 
network-wide centrality is a more decentralized organization and 
likely to regenerate leadership. In the shaping operations intro- 
duced in this paper, we seek to target nodes that will maximize this 
measure - making follow-on attacks against leadership more effec- 
tive. Previous work has primarily dealt with the problem of lead- 
ership regeneration by focusing on individuals likely to emerge as 
new leaders 1 2 ] . However, targeting or obtaining information about 
certain individuals may not always be possible. Hence, in this pa- 
per, we target nodes that affect the reduce the network's ability 
regenerate leadership as a whole. 

The main contributions of this paper is the introduction of a for- 
mal problem we call FRAGILITY (Section [XT]) which seeks to find 
a set of nodes whose removal would maximize the network-wide 
centrality. We also included in the problem a "no strike list" - nodes 
in the network that cannot be targeted for various reasons. This is 
because real- world targeting of terrorist or insurgent networks of- 
ten includes restrictions against certain individuals. We also prove 
that this problem is NP-complete (and the associated optimization 
problem is NP-hard) which means that an efficient algorithm to 
solve it optimally is currently unknown. We then provide two al- 



gorithms for solving this problem (Section III ). Our first algorithm 
is an integer program that ensures an exact solution and, though 
intractable by our complexity result, may be amenable to an in- 
teger program solver. Then we introduce a greedy heuristic that 



1 http://www.nytimesxom/2006/06/08/world/middleeast/08cnd-iraq.html?_r=l 
2 http://articlesxnnxom/2006-06-15/world/iraq.main_l_al-zarqawi-al-qaeda- 
leader-zawahiri?_s=PM:WORLD 



we show experimentally (in Section IV) to provide good results 
in practice (as we demonstrate on six different real-world terrorist 
networks) and scales to networks of 1, 133 nodes and 5, 541 edges. 
In examining five real- world terrorist networks, we found that suc- 
cessful targetting operations against only 12% (or less) of nodes 
can increase the network- wide centrality between 17% and 45%. 
Additionally, we discuss related work further in Section [V] 

We would like to note that the targeting of individuals in a ter- 
rorist or insurgent network does not necessarily mean to that they 
should be killed. In fact, for "shaping operations" as the ones de- 
scribed in this paper, the killing of certain individuals in the net- 
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work may be counter-productive. This is due to the fact that the 
capture of individuals who are likely emergent leaders may pro- 
vide further intelligence on the organization in question. 



II Technical Preliminaries and Computa- 
tional Complexity 

We assume that an undirected social network is represented by the 
graph G = (V,E). Additionally, we assume a "no strike" set, 
S C V. Intuitively, these are nodes in a terrorist/insurgent net- 
work that cannot be targeted. This set is a key part of our frame- 
work, as real- world targeting of terrorist and/or insurgents in a ter- 
rorist/insurgent network is often accompanied by real-world con- 
straints. For example, consider the following: 

• We may know an individual's relationships in the terror- 
ist/insurgent network, but may not have enough information 
(i.e. where he or she may reside, enough evidence, etc.) to 
actually target him or her. 

• The potential target may be politically sensitive. 

• The potential target may have fled the country or area of 
operations but still maintains his or her role in the terror- 
ist/insurgent network through electronic communication. 

• The potential "target" may actually be a source of intelligence 
and/or part of an ongoing counter-intelligence operation (i.e. 
as described in l3l). 

Throughout this paper we will also use the following notation. 
The symbols N G , M G will denote the sizes of V, E respectively. 
For each i G V, we will use di to denote the degree of that node 
(the number of individuals he/she is connected to) and rji to denote 
the set of neighbors and we extend this notation for subsets of V 
(for V C V, r]{V) = \J ieV ,r]i). We will use the notation K{ to 
denote all edges in E that are adjacent to node i and the notation 
d* G to denote the maximum degree of the network. Given some 
subset V C V, we will use the notation G(V) to denote the sub- 
graph of G induced by V . We describe an example network in 
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Example II.l Consider network G sam in Figure\I\ Nodes a andb 
may be leaders of a strategic cell that provides guidance to attack 
cells ( nodes c-f and g-j). Note that no members in the attack cells 
are linked to each other. Also note that if node a is the leader, and 
targeted, he could easily be replaced by b. 

A Network- Wide Degree Centrality 

We now introduce the notion of network- wide degree centrality as 
per d). The key intuition of this paper is to use this centrality as a 
measure of the network's ability to re-generate leadership. 




Figure 1: Sample network (G sarn ) for Example [II.l 



Definition II.l (Network- Wide Degree Centrality 1 1 |) The de- 
gree centrality of a network G, denoted C G is defined as: 



C G = 



(N G -l)(N G -2) 



(1) 



We note that there are other types of network- wide centrality (i.e. 
network-wide betweenness, closeness, etc.). We leave the consid- 
eration of these alternate definitions of network-wide centrality to 
future work. Freeman (T| shows that for a star network, the quan- 
tity J2i d G ~ di equals (Nq — 1) (N G — 2) - and this is the maximum 
possible value for this quantity. Hence, the value for C G can be at 
most 1. As this equation is clearly always positive, network- wide 



degree centrality is a scalar in [0, 1] . Turning back to Example II.l 
we can compute CG sam = 0.38 - which seems to indicate that in 
this particular terrorist/insurgent network that, after leadership is 
targeted, there is a cadre of second-tier individuals who can even- 
tually take control of the organization. Throughout this paper, we 
find it useful to manipulate Equation [T] as follows. 



C G 



N G d* G - 2M G 
(N G -l)(N G -2) 



(2) 



We notice that the centrality of a network really depends on 
three things: number of nodes, number of edges, and the highest 
degree of any node in the network. We leverage this re-arranged 
equation in many of our proofs. Further, we will use the function 
fragile G : V —> 3? to denote the level of network-wide of the 
graph after some set of nodes is removed. Hence, fragile G (V') = 
Cg(v-v)' We note that this function has some interesting char- 
acteristics. For example, for some subset V C V and element 
i G V - V, it is possible that fragile G (V') > fragileiV' U {%}) 
or fragile G (V f ) < fragile(V f U {i}), hence fragile G is not 
necessarily monotonic or anti-monotonic in this sense. Further, 
given some additional element j G V — V, it is possible that 
fragile G (Y' U {j}) - fragileGiV) > fragile G (V' U {i,j}) - 
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fragile G (V U {j}) or fragile G (V U {j}) - fragile G (V) < 
fragile G (V U {i,j}) - fragile G (V U {j}). Hence, fragile G 
is not necessarily sub- or super- modular either. Consider Exam- 
ple^ 

Example II.2 Consider the network G sam in Figure [7] 
Here, fragile Gsam ($) = 0.33, fragile Gsarn ({a}) = 
fragile Gsam ({b}) = 0.57, fragile Gsam ({c}) = 0.30, arcd 
fragile Gsam ({a,b}) = 0.0. The fact that fragile Gsarn ({c\ < 
fragile Gsam ($) and fragile Gsam ({a} > fragile Gsam ($) 
illustrate that fragile Gsam is not necessarily monotonic or 
anti-monotonic. Now let us consider the incremental increase of 
adding an additional element. Adding a to $ causes fragile Gsam 
to increase by 0.24 while adding a to {b} D causes fragile Gsam 
to decrease by 0.57 - implying sub-modularity. However, adding 
c to causes fragile Gsam to decrease by 0.03 while adding 
c to set {a, b} D causes fragile Gsarn to increase by 0.1 (as 
fragile Gsam ({a, 6, c} — 0.1) - implying super-modularity. Hence, 
fragile Gsam is not necessarily sub- or super- modular. 

B Problems and Complexity Results 

We now have all the pieces to introduce our problems of interest. 
We include decision and optimization versions. 

FRAGILITY (k, x, G, S): 

INPUT: Natural number k, real number x, network G = (V,E), 
and no- strike set S 

OUTPUT: "Yes" if there exists set V C V - S s.t. \V'\ < k and 
fragile G (V) > x - "no" otherwise. 

FRAGILITY DPT(k, G, S): 

INPUT: Natural number k, network G = (V, E), and no-strike set 

S 

OUTPUT: Set V C V - S s.t. \V'\ < k s.t. fiV" C V - S s.t. 
\V"\ < k and fragile G (V") > fragile G (V f ). 

As our problems seek to find sets of nodes, rather than individ- 
ual ones, it raises the question of "how difficult are these prob- 
lems." We prove that FRAGILITY is NP-Complete - mean- 
ing an efficient algorithm to solve it optimally is currently un- 
known. Following directly from this result is the NP-hardness of 
FRAGILITY _OPT. Below we state and prove this result. 

Theorem 1 (Complexity of FRAGILITY) FRAGILITY is 
NP-Complete. 



Proof. Membership in NP is trivial, consider a set V of size k, - 
clearly we can calculate fragile G (V) in polynomial time. 

Next we consider the vertex-cover (VC) problem and show that it HI Algorithms 
can be embedded into an instance of FRAGILITY. In the VC 
problem, the input consists of undirected graph G* = (V*,E*) 
and natural number k. The output is "yes" iff there is a set 
V** C V* of size at most k s.t. for all (i, j) e E*, either i 



or j (or both) are in V*. This problem is well-known to be NP- 
hard. First we create a new network G = (V,E) which con- 
sists of graph G* but with N G * + 2 additional nodes which form 
a star that is disconnected from the rest of the network. All of 
the new nodes are put in the no- strike set S (part of the input 
of FRAGILITY). Clearly, the center of this star is always the 
most central node in the graph, no matter what is removed from set 
V — S. This allows us to treat d* G as a constant equal to N G + 1. 
Also note that with this construction, for both problems, if a so- 
lution exists of less than size k, there also exists a solution of ex- 
actly size k. Further, we note that for any subset of V whose re- 
moval does not affect the overall maximal degree of the network 
(which is any node outside the set S - hence in some correspond- 
ing subset of V* in the graph of the dominating set problem), when 
some set V (of size k) is removed from V, the network- wide de- 
gree centrality for the resulting graph can be expressed as follows: 

jrague G {v )- (at g -/c- 1) (at g -/c-2) 

The proof of correctness of the embedding rests on proving that a 
"yes" answer is returned for the vertex cover problem iff 
FRAGILITY ^^t-t^ ,G,S) = "yes". 
First, suppose by way of contradiction (BWOC) there is a "yes" 
answer to the VC problem and a "no" answer to the corresponding 
FRAGILITY problem. Let V** be the set of nodes that cause 
a "yes" answer to VC. If we remove the corresponding nodes 
from G, there are N G * + 1 edges left in that network. Hence, as 
this is a set of size k (thus, meeting the cardinality requirement of 
FRAGILITY then fragile G (V**) = 

which would cause a "yes" answer for FRAGILITY - hence a 
contradiction. 

Going the other direction, suppose BWOC there is a "yes" answer 
to the FRAGILITY problem and a "no" answer to the corre- 
sponding VC problem. Let V be the nodes in the solution to 
FRAGILITY . Clearly, this set is of size k and by how we set 
up the no-strike list (S), there are corresponding nodes in G**. As 
these nodes cause a "yes" answer to FRAGILITY, they result in 
the removal of M G * number of edges in G. By the construction, 
none of these edges are adjacent to nodes in S. Hence, there are 
corresponding edges in G*. As this is also the number of edges 
in G*, then this set is also a vertex cover - hence a contradiction. 
Hence, as we have shown membership in NP and that this problem 
is at least as hard as the dominating set problem (resulting in NP 
hardness), the statement of the theorem follows. 

Corollary 1 (Hardness of FRAGILITY. OPT) 
FRAGILITY DPT is NP-hard 

Proof. Follows directly from Theorem [T] 



Now with the problems and their complexity identified, we pro- 
ceed to develop algorithms to solve them. First, we develop an 
integer program that, if solved exactly, will produce an optimal 
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solution. We note that solving a general integer program is also 
NP-hard. Hence, an exact solution will likely take exponential 
time. However, good approximation techniques such as branch- 
and-bound exist and mature tools such as QSopt and CPLEX can 
readily take and approximate solutions to integer programs. We 
follow our integer program formulation with a greedy heuristic. 
Though we cannot guarantee that the greedy heuristic provides an 
optimal solution, it often provides a natural approach to approxi- 
mating many NP-hard optimization problems. 

A Integer Program 

Our first algorithm is presented in the form of an integer program. 
The idea is that certain variables in the integer program correspond 
with the nodes in the original network that can be set to either 
or 1. An objective function, which mirrors the fragile function 
is then maximized. When this function is maximized, all nodes 
associated with a 1 variable are picked as the solution. 

Definition III.l (FRAGILITY J P) For each i e V, create 
variables Xi,Zi. For each undirected edge ij G E, create three 
variables: Y^, Qij, Qji. Note that the edge is considered in only 
(i one direction " for the Y variables and both directions for the Q 
variables. We define the FRAGILITY .IP integer program as 
follows: 



max 



(Afc-Ei Xj) E tj Qij -2 E tj Yjj 

(NG-l-^XiXNG-2-^Xi) 



Subject to: 







(3) 




EiZi = i 


(4) 


Wij e E 


Yij < 1 — Xi 


(5) 


yij e E 


Yij < 1 - Xj 


(6) 


yij e E 


Qij 5^ Yij 


(7) 


\/ij e E 


Qij — Yji 


(8) 


yij e E 


Qij ^ Z{ 


(9) 


Vt G V 


ZiG {0,1} 


(10) 


yieS 


Xi = 


(ID 


yieV-S 


Xi e {0, 1} 


(12) 



Next we prove how many variables and constraints 
FRAGILITY _IP requires as well as prove that it provides 
a correct solution to FRAGILITY .OPT . 



Proposition III.l FRAGILITY J P has 2N G 
and 2 + 2Nq + 5Mg constraints. 



3Mq variables 



vector X returned by 
i is a solution to 



Proposition III.2 (I.) Given the 
FRAGILITY J P, the set \Jx=i 
FRAGILITY. OPT. 

(2.)Given a solution V to FRAGILITY DPT \ Mi e S,X = 1 
and Mi £ 5, X = will maximize FRAGILITY J P. 



Proof. (I.) Suppose, BWOC, Ux =i * * s not an °pti ma l solution 
to FRAGILITY. OPT. Then there is some V ^ Ux<=i i that 
is. Suppose Mi e S, X = 1 and Mi £ S, X = 0. Clearly, by the 
definition of a solution to FRAGILITY DPT \ constraints [3|TT| 
and Q2] are all met. Constraints \5\ and [6] set variables associated 
with edges adjacent to nodes not in V to 1. Hence, the quantity 
Y^ij Yij is equal to the number of edges in the network. The Y 
edge variables (both of them for each edge) are also set in a similar 
manner. Constraints |4|10| ensures that only one set of such edge 



variables are set to 1. Hence, the quantity J2i Xi) Yij Qij ^ s m e 
degree of one node in the network. As this quantity is present in the 
objective function and non-negative, it corresponds to the d* G . As 
we note that Yi Xi is equal to the number of nodes in G when V 
is removed, we see that this function is fragilec- As this quantity 
is maximized, we have a contradiction. 

(2.) Suppose, BWOC, Mi e S, X = 1 and Mi <£ S, X = is 
not an optimal solution to FRAGILITY JP. Using the same 
line of reasoning as above, we see that the objective function of 
FRAGILITY J P is the same as fragilec, which also gives us 
a contradiction. 

Note that this integer program does not have a linear objec- 
tive function. However, this can be accommodated for by instead 
solving k different integer programs and taking the solution from 
whichever one returns the greatest value for the objective function 
(that is greater than the initial network-wide degree centrality, of 
course). In this case, each integer program is identified with a nat- 
ural number i G {1, . . . , k} and the ith integer program has the 
following objective function: 

(iV G -;)£.. Q^- -2 Fo- 



rnax 



(N G -l-i)(N G - 

As well as constraint [3] as follows: 



2-i) 



(13) 



(14) 



Notice that now the quantities [Nq — i) and [Nq — (Nq — 
2 — i) can be treated as constants, making the objective function 
linear. However, for networks with a heterogeneous degree distri- 
bution where Nq » A:, it is likely that only the integer program 
for the case where i = k is needed as removing any node with 
edges that is unconnected to a maximal degree node will result in 
an increase in network- wide degree centrality. 

Again, we stress that FRAGILITY _IP provides an exact so- 
lution. As integer-programming is also NP-hard, solving these 
constraints is likely intractable unless P = NP. However, tech- 
niques such as branch-and-bound and mature solvers such as QSopt 
and CPLEX can provide good approximate solutions to such con- 
straints. Even if the integer program must be linear, we can use the 
techniques described above to solve k smaller integer programs or 
obtaining an approximation by treating the terms involving the total 
number of nodes in the resulting graph (in the objective function) 
as constants. Additionally, a relaxation of the above constraints 
where Zi and Xi variables lie in the interval [0, 1] is solvable in 
polynomial time and would provide a lower-bound on the solu- 
tion to the problem (although this would likely be a loose bound in 
many cases). 
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B A Greedy Heuristic 
The integer program introduced in the last section can be lever- 
aged by an integer-program solver for an approximate solution to 
FRAGILITY DPT. However, it likely will not scale well to ex- 
tremely large networks. Therefore, we introduce a greedy heuristic 
to find an approximate solution. The ideas is to iteratively pick the 
node in the network that provides the greatest increase in fragile 
- and does not cause a decrease. 

Algorithm 1 GREEDY_FRAGILE 



[7] suppc 



2 using the ter- 



Require: Network G 

constraint k 
Ensure: Subset V 



(V,E), no- strike set S C V, cardinality 



0, haveV alidScore 



1: V = 
2: flag = TRUE 
3: while \V'\< k and flag do 
4: curBest = null, curBestScore 

FALSE 
5: for i e V - (V U S) do 

6: curScore = fragilec^' U {%}) — fragileciy') 

7: if curScore > curBestScore then 

8: curBest = i 

9: curBestScore = curScore 

10: haveV alidScore = TRUE 

11: end if 
12: end for 

13: if haveV alidScore = FALSE then 
14: /Zaflf = FALSE 
15: else 

16: V = V U {curBest} 
17: end if 
18: end while 
19: return V 7 . 

The following two propositions describe characteristics of the 
output and run-time of GREEDY .FRAGILE, respectively. 

Proposition III.3 If GREEDY -FRAGILE returns a non- 
empty solution (V), then \V'\ < k and fragilec(V f ) > 
fragile G (Q). 

Proof. As the algorithm terminates its main loop once the cardi- 
nality of the solution reaches k and as in each iteration, the variable 
curBestScore is initialized as zero, the statement follows. 

Proposition III.4 GREEDY _FRAGILE runs in O(kN^) 
time. 

Proof. We note that fragile is computed in 0(Nq) time as it 
must update the node with the maximum degree. As the outer loop 
of the algorithm iterates at most k times and the inner loop iterates 
Nq times, the statement follows. 

Though our guarantees on GREEDY -FRAGILE are limited, 
we show that it performs well experimentally in the next section. 



Example III.l Following from Examples 

wrist/insurgent network G sam from FigureUj suppose a user wants 
to identify 3 nodes that will cause the network to become " 'as fragile 
as possible " and is able to target any node. Hence, he would like 
to solve FRAGILE jOPT(3, G sarm 0) and decides to do so us- 
ing GREEDY -FRAGILE. Initially, fragile Gsam (9) = 0.33. 
In the first iteration, it selects and removes node a, increasing 
the fragility (fragileG sam ({a}) = 0.57). In the next itera- 
tion, it selects node j, giving us fragileG sarn ({a,j}) = 0.57. 
Finally, in the third iteration, it picks node c. This results in 
fragileG sam ({cL, j, c}) = 0.6. The algorithm then terminates. 



IV Implementation and Experiments 

All experiments were run on a computer equipped with an Intel 
Core 2 Duo CPU T9550 processor operating at 2.66 GHz (only 
one core was used). The machine was running Microsoft Windows 
7 (32 bit) and equipped with 4.0 GB of physical memory. We im- 
plemented the GREEDY.FRAGILE algorithm using Python 2.6 in 
under 30 lines of code that leveraged the NetworkX library avail- 
able from http://networkx.lanl.gov/. 

We compared the results of the GREEDY_FRAGILE to three 
other more traditional approaches to targeting that rely on central- 
ity measures from the literature. Specifically, we look at the top 
closeness and betweenness nodes in the network. Given node i, 
its closeness is the inverse of the average shortest path length from 
node i to all other nodes in the graph. Betweenness, on the other 
hand, is defined as the number of shortest paths between node pairs 
that pass through i. Formal definitions of both of these measures 
can be found in (H. 

A Datasets 

We studied the effects of our algorithm on five different datasets. 
The network Tanzania [ 5 ] is a social network of the individuals 
involved with the Al Qaeda bombing of the U.S. embassy in Dar 
es Salaam in 1998. It was collected from newspaper accounts by 
subject matter experts in the field. The remainder networks, Gen- 
TerrorNwl-GenTerrorNw4 are terrorist networks generated from 
real- world classified datasets (U [3. The Tanzania and the GenTer- 
rorNwl-GenTerrorNw4 datasets used in our analysis were multi- 
modal networks, meaning they contain multiple node classes such 
as Agents, Resources, Locations, etc. The presence of the different 
node classes generate multiple or meta networks, which, in their 
original state, do not provide the single-mode Agent by Agent net- 
work needed to test our algorithms. Johnson and McCulloh (8) 
demonstrated a mathematical technique to convert meta networks 
into single-mode networks without losing critical information. Us- 
ing this methodology, we were able to derive distant relationships 
between nodes as a series of basic matrix algebra operations on all 
five networks. The result is an agent based social network of poten- 
tial terrorist. Characteristics of the transformed networks of agent 
node class only can be found in Table [T] 
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Table 1 : Network Datasets 



Name 


Nodes 


Edges 


Density 


Avg. Degree 


Tanzania 


17 


29 


0.213 


3.412 


GenTerrorNwl 


57 


162 


0.102 


5.684 


GenTerrorNw2 


102 


388 


0.0753 


7.608 


GenTerrorNw3 


105 


590 


0.108 


11.238 


GenTerrorNw4 


135 


556 


0.0615 


8.237 


URV E-Mail 


1,133 


5,541 


0.00864 


9.781 


CA-NetSci 


1,463 


2,743 


0.00256 


3.750 



B Increasing the Fragility of Networks 
In our experiments, we showed that our algorithm was able to sig- 
nificantly increase the network-wide degree centrality by remov- 
ing nodes - hence increasing the fragile function with respect to 
a given network. In each of the five real- world terrorist networks 
that we examined, removal of only 12% of nodes can increase the 
network- wide centrality between 17% and 45% (see Figures [5][7]). 
In Figure [2] we show a visualization of how the Tanzania network 
becomes more "star-like" with subsequent removal of nodes by the 
greedy algorithm. 




m*mudjbajha(ma| 





mahmudjbouhalimai 




Figure 2: Visualization of the Tanzania network after nodes re- 
moved by GREEDY.FRAGILE. Panel A shows the original net- 
work. Panel B shows the network after 3 nodes are removed, panel 
C shows the network after 5 nodes are removed, and panel D shows 
the network after 9 nodes are removed. Notice that the network 
becomes more "star-like" after subsequent node removals. In our 
experiment, after GREEDY.FRAGILE removed 11 of the nodes 
in the network, it took the topology of a star. 

For comparison, we also looked at the removal of high degree, 
closeness, and betweenness nodes. Removal of high-degree, close- 
ness, or betweenness nodes tended to increase the network-wide 
centrality. In other words, traditional efforts of targeting lead- 
ership without first conducting shaping operations may actually 
increase the organization's ability to regenerate leadership - as 
such targeting operations effectively cause an organization to de- 



centralize. We display these results graphically in Figures |3]|7 
Notice that GREEDY.FRAGILE consistently causes an increase 
in the network-wide degree centrality. An analysis of variance 
(ANOVA) reveals that there is a significant difference in the per- 
formance among our algorithm and the centrality measures with 
respect to increase or decrease in network-wide degree centrality 
(p- value less than 2.2 • 10 -16 , calculated with R version 2.13). Ad- 
ditionally, pairwise analysis conducted using Tukey's Honest Sig- 
nificant Difference (HSD) test indicates that the results of our al- 
gorithm differ significantly from any of the three centrality mea- 
sures with a probability approaching 1.0 (95% confidence, calcu- 
lated with R version 2.13). Typically, the ratio of percent increase 
in fragility to the percent of removed nodes is typically 2 : 1 or 
greater. 
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Figure 3: Percent of nodes removed vs. percent increase in fragility 
for the Tanzania network using GREEDY.FRAGILE, top degree, 
top closeness, and top betweenness. The scale of the x-axis is po- 
sitioned at 0%. 



C Runtime 

We also evaluated the run-time of the GREEDY_FRAGILE algo- 
rithm. With the largest terror network considered (GenTerrorNw4), 
we achieved short runtime (under 7 seconds) on standard com- 
modity hardware (see Figure [8]). Hence, in terms of runtime, our 
algorithm is practical for use by a real-world analyst. As pre- 
dicted in our time complexity result, we found that the runtime 
of GREEDY_FRAGILE increases with the number of nodes re- 
moved. We note that the implementations of top degree, closeness, 
and betweenness calculate those measures for the entire network at 
once - hence increasing the number of nodes to remove does not 
affect their runtime. 

D Experiments on Large Data-Sets 

To study the scalability of GREEDY.FRAGILE, we also employed 
it on two large social networks. Note that these datasets are not 
terrorist or insurgent networks. However, the larger size of these 
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Figure 4: Percent of nodes removed vs. percent increase in fragility 
for the GenTerrorNetl network using GREEDY_FRAGILE, top 

degree, top closeness, and top betweenness. The scale of the x-axis 
is positioned at 0%. 



Figure 5: Percent of nodes removed vs. percent increase in fragility 
for the GenTerrorNw2 network using GREEDY_FRAGILE, top 
degree, top closeness, and top betweenness. The scale of the x-axis 
is positioned at 0%. 



datasets is meant to illustrate how well our approach scales. For 
these experiments, we used an e-mail network from University 
Rovira i Virgili (URV E-Mail) |9] and a Network Science col- 
laboration network (CA-NetSci) from ifTOl (see Table [1}. In Fig- 
ure [9] we show the percentage of nodes removed vs. the percent 
increase in fragility. We note that 2 : 1 ratio of percent increase in 
fragility to the percent of removed nodes appears to be maintained 



even in these large datasets. In Figure 10 we show the runtime for 
GREEDY_FRAGILE on the two large networks. We note that the 
behavior of runtime vs. number of nodes removed resembles that 
of the GenTerrorNw4 network from the previous section. Also of 
interest is that the algorithm was able to handle networks of over a 
thousand nodes in about 20 minutes on commodity hardware. 



V Related Work 

Various aspects of the resiliency of terrorist networks have been 
previously explored in the literature. For instance, studies the 
ability such network to facilitate communication while maintain- 
ing secrecy while lfT2l studies how such networks are resilient to 
cascades. However, to our knowledge, the network- wide degree 
centrality in such networks - and how to increase this property - 
has not been previously studied. 

There has been much work dealing with the removal of nodes 
from a network to maximize fragmentation fT3l [T4l IT31 where the 
nodes removed are mean to either increase fragmentation of the 
network or reduce the size of the largest connected component. 
While this work has many applications, it is important to note that 
there are special considerations of terrorist and insurgent networks 
that we must account for in a targeting strategy. For instance, if 
conducting a counter-intelligence operation while targeting, as in 
the case of |3], it may be desirable to preserve some amount of 



connectivity in the network. Additionally, fragmentation of a net- 
work may result in the splintering of an organization into smaller, 
but more radical and deadly organizations. This happens because 
in some cases, it may be desirable to keep certain terrorist or in- 
surgent leaders in place to restrain certain, more radical elements 
of their organization. Such splinter was observed for the insurgent 
organization Jaysh al-Mahdi in Iraq fl6l . Further, these techniques 
do not specifically address the issue of emerging leaders. Hence, if 
they were to be used for counter-terrorism or counter-insurgency, 
they would likely still benefit from a shaping operation to reduce 
organization's ability to regenerate leadership. 

There has been some previous work on identifying emerging 
leaders in terrorist networks. Although such an approach could 
be useful in identifying certain leaders, it does not account the or- 
ganizations ability as a whole to regenerate leadership. In Q, the 
topic of cognitive demand is studied. The cognitive load of an indi- 
vidual deals with their ability to handle multiple demands on their 
time and work on complex tasks. Typically, this can be obtained 
by studying networks where the nodes may represent more than in- 
dividual people - but tasks, events, and responsibilities. However, 
it may often be the case that this type of information is often lim- 
ited or non-existent in many situations. Additionally, as discussed 
throughout this paper, the targeting of individual nodes may often 
not be possible for various reasons. Hence, our framework, that fo- 
cuses on the network's ability to regenerate leadership as opposed 
to finding individual emerging leaders may be more useful as we 
can restrict the available nodes in our search using the "no strike 
list." By removing these nodes from targeting consideration - but 
by still considering their structural role - our framework allows a 
security force to reduce the regenerative ability of a terror network 
by "working around" individuals that may not be targeted. 

In more recent work [ 17 ] looks at the problem of removing lead- 
ership nodes from a terrorist or criminal network in a manner that 
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Figure 7: Percent of nodes removed vs. percent increase in fragility 
for the GenTerrorNw4 network using GREEDY_FRAGILE, top 

degree, top closeness, and top betweenness. The scale of the x-axis 
is positioned at 0%. 



accounts for new links created in the aftermath of an operation. 
Additionally, fT8l look at identifying leaders in covert terrorist net- 
work who attempt to minimize their communication due to the 
clandestine nature of their operations. They do this by introduc- 
ing a new centrality measure called "covertness centrality." Both 
of these approaches are complementary to ours as they focus on 
the leadership of the terrorist or insurgent group - as this approach 
focuses on the networks ability to re-generate leadership. A more 
complete integration of this approach leadership targeting method 
such as these (i.e. using a network- wide version of covertness cen- 
trality) is an obvious direction for future work. 



VI Conclusions 

In this paper we described how to target nodes in a terrorist or insur- 
gent network as part of a shaping operation designed to reduce the 
organization's ability to regenerate leadership. Our key intuition 
was to increase the network-wide degree centrality which would 
likely have the effect of eliminating emerging leaders as maximiz- 
ing this quantity would intuitively increase the organization's re- 
liance on a single leader. In this paper, we found that though identi- 
fying a set of nodes to maximize this network- wide degree central- 
ity is NP-hard, our greedy approach proved to be a viable heuris- 
tic for this problem, increasing this quantity between 17% — 45% 
in our experiments. Future work could include an examination of 
other types of network- wide centrality - for instance network- wide 
closeness centrality - instead of network-wide degree centrality. 
Another aspect that we are considering in ongoing research is de- 
termining the effectiveness of the shaping strategy when we have 
observed only part of the terrorist or insurgent organization - as is 
often the case as such networks are created from intelligence data. 
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